[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eCloud Data Fusion utilizes role-based access control (RBAC) to manage permissions for accessing and manipulating resources, offering fine-grained control at the namespace level.\u003c/p\u003e\n"],["\u003cp\u003eThe resource hierarchy in Cloud Data Fusion starts from the Google Cloud project down to namespaces, and includes data plane resources such as connections, secure keys, pipelines, artifacts, and compute profiles.\u003c/p\u003e\n"],["\u003cp\u003ePredefined RBAC roles in Cloud Data Fusion include Instance Access, Viewer, Operator, Developer, Editor, and Instance Admin, each granting different levels of access to resources within instances and namespaces.\u003c/p\u003e\n"],["\u003cp\u003eCustom roles can be created to address specific access needs not covered by predefined roles, allowing for tailored permissions, such as limiting access to secure keys or providing read-only access to them.\u003c/p\u003e\n"],["\u003cp\u003eIAM roles are less granular than RBAC roles, but take precedence when both are applied to a principal.\u003c/p\u003e\n"]]],[],null,["# RBAC roles and permissions\n\nThis page describes the roles and permissions used by Cloud Data Fusion\ninstances with\n[role-based access control](/data-fusion/docs/concepts/rbac)\n(RBAC) enabled.\n\nFor fine-grained access enforcement at the namespace level and lower, use these\ndata plane resources and permissions with RBAC.\n\nResource hierarchy\n------------------\n\nCloud Data Fusion resources have the following resource hierarchy:\n\nThis figure shows the resource hierarchy in descending order (broadest to\nnarrowest): Google Cloud project, location, Cloud Data Fusion instance, and\nnamespaces. Below namespaces, in no order, are connections, secure keys,\npipelines, artifacts (such as plugins, drivers, and applications), and compute\nprofiles.\n\nThe following resources are Cloud Data Fusion [data plane](/data-fusion/docs/concepts/overview#data-fusion-studio)\nresources that you control with the REST API or in the Cloud Data Fusion\nStudio: namespaces, connections, secure keys, pipelines, artifacts, and compute\nprofiles.\n\nPredefined roles for RBAC\n-------------------------\n\nCloud Data Fusion RBAC includes several predefined roles that you can use:\n\nInstance Access role (`datafusion.accessor`)\n: Grants the principal access to a Cloud Data Fusion instance, but not to\n any resources within the instance. Use this role in combination with other\n namespace-specific roles to provide fine-grained access to namespace.\n\nViewer role (`datafusion.viewer`)\n: Grants access to a principal on a namespace to view pipelines, but not to\n author or run pipelines.\n\nOperator role (`datafusion.operator`)\n: Grants access to a principal on a namespace to access and run pipelines,\n change the compute profile, create compute profiles, or upload artifacts.\n Can perform the same actions as a developer, with the exception of\n previewing pipelines.\n\nDeveloper role (`datafusion.developer`)\n: Grants access to a principal on a namespace to create and modify limited\n resources, such as pipelines, within the namespace.\n\nEditor role (`datafusion.editor`)\n: Grants the principal full access to all Cloud Data Fusion resources\n under a namespace within a Cloud Data Fusion instance. This role must\n be granted in addition to the Instance Accessor role to the principal. With\n this role, the principal can create, delete, and modify resources in the\n namespace.\n\nInstance Admin role (`datafusion.admin`)\n: Grants access to all resources within a Cloud Data Fusion instance.\n Assigned through IAM. Not assigned at the namespace level\n through RBAC.\n| **Note:** A Cloud Data Fusion IAM role contains a number of permissions. They're less granular than RBAC roles. A combination of IAM and RBAC permissions are applied to each principal. IAM roles also have precedence over RBAC roles\n\n^\\*^ The principal must have the Data Fusion Admin IAM role, not the Instance Admin RBAC role.\n\n\u003cbr /\u003e\n\nFor a complete list of permissions included in Cloud Data Fusion's\npredefined role, see\n[Cloud Data Fusion predefined roles](/iam/docs/understanding-roles#cloud-data-fusion-roles).\n\nCustom roles for RBAC\n---------------------\n\nSome use cases cannot be implemented using the predefined roles for Cloud Data Fusion. In these cases, create a\n[custom role](/iam/docs/creating-custom-roles).\n\n### Examples\n\nThe following examples describe how to create custom roles for RBAC:\n\n- To create a custom role that only gives access to the secure keys within a\n namespace, create a custom role with the `datafusion.namespaces.get` and\n `datafusion.secureKeys.*` permissions.\n\n- To create a custom role that gives read-only access to secure keys, create a\n custom role with the `datafusion.namespaces.get`,\n `datafusion.secureKeys.getSecret`, and `datafusion.secureKeys.list`\n permissions.\n\nPermissions for common actions\n------------------------------\n\nA single, predefined permission might not be sufficient to perform the\ncorresponding action. For example, to update namespace properties, you might\nalso need `datafusion.namespaces.get` permission. The following table describes\ncommon actions performed within a Cloud Data Fusion instance and the\nrequired IAM permissions:\n\n^\\*^ Artifacts, such as plugins and drivers, are items that you upload in Cloud Data Fusion for developing pipelines.\n\n\u003cbr /\u003e\n\nWhat's next\n-----------\n\n- Learn more about [RBAC](/data-fusion/docs/concepts/rbac) in Cloud Data Fusion."]]
